Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
Broadcom issued emergency updates for VMware ESX, vCenter, Workstation and Fusion, fixing five flaws including CVE-2026-59309 (CVSS 9.8 authentication bypass in vCenter) and CVE-2026-59310 (CVSS 9.8 directory traversal allowing code execution). CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the ESX VMXNET3 adapter that permits a virtual machine escape to the host. Broadcom found no evidence of exploitation, but Defused Cyber reported a spike in vCenter scanning on August 11, 2026 consistent with exploitation attempts against CVE-2026-59309 (VMSA-2026-0006). No workarounds are available.
- CVE-2026-59309 and CVE-2026-59310 (both CVSS 9.8) allow vCenter authentication bypass and code execution via directory traversal.
- CVE-2026-47876 (CVSS 9.3) enables VM escape from guest to ESX host via VMXNET3 out-of-bounds write.
- No confirmed exploitation, but honeypots show increased scanning of vCenter SSO endpoints for CVE-2026-59309.
- No workarounds; Broadcom classified the updates as an emergency change requiring immediate action.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-41703 | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure. NVD description · AI analysis pending | 7.6 | <1% | — | — | ||
| CVE-2026-41709 | VMware ESX contains an insufficient logging vulnerability. VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged. NVD description · AI analysis pending | 2.7 | <1% | — | — | ||
| CVE-2026-47876 | VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue. NVD description · AI analysis pending | 9.3 | <1% | — | — | ||
| CVE-2026-59309 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. NVD description · AI analysis pending | 9.8 | 8% |
| — | ||
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog CVE-2026-59310 is a directory traversal (CWE-22) vulnerability in the Syslog server component of VMware vCenter Server, rated critical at CVSS 9.8. It can be triggered over the network without authentication or user interaction, allowing a malicious actor with network access to vCenter to achieve arbitrary code execution. An attacker who exploits it gains code execution on the vCenter appliance, and reported campaigns show it has been used to establish persistent remote access and, by a suspected China-nexus actor, to deploy Babuk ransomware. Any organization running an affected version of vCenter Server is exposed, especially where the management interface is reachable from the internet; the available data does not specify affected version ranges. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-18, it was reportedly exploited just five days after disclosure, and EPSS estimates a 45.9% probability of exploitation within 30 days (99th percentile). Do: Upgrade vCenter Server to the patched release identified in Broadcom's advisory (no specific version ranges are provided in this data) and prioritize any vCenter that is internet-facing, in line with CISA KEV and BOD 26-04 requirements for federal agencies. Until patched, restrict access to the vCenter management interface to trusted networks and verify whether the vCenter Syslog server is enabled. Hunt for compromise indicators, including unexplained remote-access persistence and Babuk ransomware artifacts, given the documented China-nexus exploitation. | 9.8 | 46% | KEV ransomware |
| largeApproximately 50,000-100,000 internet-exposed vCenter Server instances, with total deployments (including internal-only) likely in the hundreds of thousands |
Full article529 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 29, 2026Vulnerability / Enterprise Security
Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity.
The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter.
"A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system," Broadcom said.
The second critical flaw is a directory-traversal vulnerability in vCenter (CVE-2026-59310, CVSS score: 9.8) that a malicious actor with network access can exploit to execute arbitrary code. Both vulnerabilities have been addressed in the versions below -
- VMware Cloud Foundation, VMware vSphere Foundation versions 9.1.x.x (Fixed in 9.1.0.0300)
- VMware Cloud Foundation, VMware vSphere Foundation versions 9.0.x.x (Fixed in 9.0.2.0100)
- VMware vCenter version 8.0 (Fixed in 8.0 U3k)
- VMware Cloud Foundation versions 5.x (Async patch to 8.0 U3k)
Also patched by Broadcom are three other flaws -
- CVE-2026-47876 (CVSS score: 9.3) - An out-of-bounds write vulnerability in the VMXNET3 virtual network adapter of VMware ESX that a malicious actor with local administrative privileges on a virtual machine can exploit to execute code on the host. (Fixed in VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.1.0.0200-25557999 and ESXi-9.0.2.0100-25595025, and VMware ESX ESXi80U3k-25595708)
- CVE-2026-41703 (CVSS score: 7.6) - An out-of-bounds read vulnerability in VMware ESX that a malicious actor with VM deployment privileges could trigger, potentially leading to information disclosure or a denial-of-service (DoS) condition. On VMware Workstation and Fusion, the impact is limited to information disclosure. (Fixed in VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025, VMware ESX ESXi80U3i-25205845, VMware Workstation 26H1, VMware Fusion 26H1, and VMware Cloud Foundation 5.2.3)
- CVE-2026-41709 (CVSS score: 2.7) - An insufficient logging vulnerability in VMware ESX that a malicious administrator can exploit to perform certain operations without them being logged. (Fixed in VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025, and VMware ESX ESXi80U3j-25429389)
Broadcom noted that it has found no evidence to suggest any of these issues have been exploited in the wild. However, there are no available workarounds, and the company has categorized the updates as an emergency change requiring immediate action.
The technology giant also characterized CVE-2026-47876 as a virtual machine escape. "An attacker who already holds local administrative privileges inside a virtual machine that uses the VMXNET3 virtual network adapter may execute code on the ESX host," it said.
Update
Defused Cyber, in a post shared on X on August 11, 2026, said it's observing a spike in scanning against VMware vCenter that are indicative of potential exploitation efforts targeting CVE-2026-59309.
"Our honeypots are logging increased fingerprinting – such as version probes via POST /sdk/ (RetrieveServiceContent) and walks of the /websso SAML SSO flow – coinciding with Broadcom's VMSA-2026-0006 (CVE-2026-59309, unauth auth-bypass in vmdir, CVSS 9.8)," the cybersecurity company said.
(The story was updated after publication on August 11, 2026, to include insights from Defused Cyber.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/07/three-critical-vmware-flaws-allow-auth.html